MouseAT

Nice, glad to hear you got there in the end. I've never worked with Cubase 10, so I don't know if the command lines for the e-Licenser are any different, but now that you've sussed out the certificate part, that's bit's universal.

Samsung drives are usually awesome. We've been buying Western Digital Green 240GB drives for the last 6 months or so, with a good track record so far, and we certainly can't fault the price. I'd stay well clear of Integral, as I've seen way too many of those drives fail. Double digit percentage failures within 9 months, and several dead on arrival does not give me any confidence in their quality control.

I wonder if it has something to do with the certificate import - perhaps the certificate store doesn't work the same way during the task sequence? Usually, if you're getting a prompt regarding trusting publishers, it's because the certificate isn't in the store. I wouldn't know how MDT would be affected, as I've only done the install using SCCM, and it's always been done in the background after the task sequence has already completed.

That's a no go - it's one of the ones our media department asked us to look into. The free version is only licensed for a single user on a single machine. The professional versions appear to require individual activation, and do not provide any means of transferring a licence from one computer to another. There's no way that'll fly in an environment like ours.

Thanks for all the suggestions so far. I'll have to check some of these out over the next few days. Yeah, I suspect that may be the way in which we end up handling this, at least if my current approach of seeing if there are any existing rooms where I can free up MoviePlus if it's no longer required doesn't pan out. It doesn't help that the school decided to put in a new IT suite over the summer, primarily for media, without any consideration for the fact that all of our MoviePlus licences are already allocated elsewhere on site. At the end of the day, I'm just trying to cover as many bases as possible here, so that if it comes down to the crunch, I can offer some options, each with pros and cons. If the bosses get involved, it's easy enough for me to explain the situation, lay a few viable options on the table and leave the choice to them. My intention is just to have some options that might work to help offset the fact that I've already shot down two suggestions that absolutely won't work due to technical limitations or licence restrictions. If some of the options are more limited in functionality, or come at significant expense to the school, that isn't really my problem - I didn't create this situation, so it's not my job to find some magical, perfect solution that probably doesn't exist.

I'm looking for a bit of advice regarding video editing software that's easily deployable and manageable across large numbers of PCs. Our media department have been using Serif MoviePlus for their video editing for a number of years. We currently have 200 licences, and are currently right on our limit for numbers. As our school has added an additional IT room over the summer, and has re-roomed some of the media classes for the 2018-2019 academic year, we're now in the position where the media department have requested MoviePlus on additional machines. As MoviePlus is a discontinued product, we can no longer purchase additional licences, so whilst we're currently in discussions to see if we can relocate some of our existing licences from elsewhere on our site, we may have to start looking at alternatives. We've had a couple of requests from one of the media teachers, along the lines of "commercial product X has a cut down, free version, can we install that?". On both occasions, said free version only allows individual use on one machine by one individual, and/or requires individual activation on each PC. In one case, even the commercial version had to be activated individually on each computer, and provided no way to transfer a licence around. Any video editing application that we use would have to be installed on at least 235 machines, so this isn't a feasible solution. My question is this: Does anyone have any recommendations for cost effective video editing software that can easily be deployed and managed across large numbers of computers? Full site licences would be ideal, fixed numbers of seats would also be feasible for us. Some sort of product activation via. some sort of licensing server wouldn't present a problem, but any sort of manual activation is a no-go - we need a solution where SCCM can put the software on an imaged computer and the software is good to go without any manual intervention.

I think it's in trusted publishers, but I'm a bit rusty on this. I haven't built a Cubase deployment for a few years, and it's not in our deployment system at my current place of work.

Looking at the status on Office 365 Admin, they're still working on this. Apparently their fix wasn't rolling out properly across the broken servers due to a "configuration issue" that they say is now fixed. My apps launcher is now showing all of the applications again, but I doubt it's fixed for everyone yet.

It seems it's my turn to be affected by this. It was fine this morning, but now I'm only getting the four icons. I guess everything must be load balanced behind the scenes, and whether or not you're affected is going to depend on whether you're directed to a server with the certificate problem or not.

It seems it's my turn to be affected by this. It was fine this morning, but now I'm only getting the four icons. I guess everything must be load balanced behind the scenes, and whether or not you're affected is going to depend on whether you're directed to a server with the certificate problem or not.

MS are apparently fixing it globally. There's an entry in the Exchange Online status page in Office 365 admin. Estimated resolution time is by 7pm tonight.

I just found this support thread exchange between MathsWatch and EduGeek. It's the most hilarious thing I've read all week: https://vimeo.com/forums/help/topic:285477 "Aaargh, schools are complaining that they can't access our content? How do we make it work without them unblocking all of Vimeo, including the NSFW parts? WHAT DO YOU MEAN THEY CAN'T? AAAARGH!"

I've only done the e-Licenser as a scripted install (using System Center) for Cubase 7. Depending on the particular release of the e-Licenser, there should be a silent install command. For Cubase 7, the command was: eLicenserControlSetup.exe --mode unattended --unattendedmodeui none I believe older versions of the e-Licenser used the /S parameter. The main problem is that if you try this on most PCs, you'll be prompted to approve the installation of the driver, as Windows won't trust the certificate out of the box. To work around that, perform the install on one machine manually, grab the Steinberg certificate from the local certificate store, then use a command like the following to install the certificate: certutil -addstore "TrustedPublisher" Steinberg.cer If you silently install the certificate with certutil first, you can then perform a silent install from the e-Licenser EXE without running into the certificate prompt. Other than some sort of start up or shut down script (scheduled task?) to check for the presence of the e-Licenser and perform an installation if necessary, I don't know how you could do it with just a GPO unless you're enough of a wizard with MSI files to be able to create an MSI that just wraps around the existing EXE installer. I suppose you could potentially build the e-Licenser components into a base image or deploy them as part of a task sequence in MDT if that's an option.

I was playing around yesterday with a proxy port set to NTLM (via redirect), and found that the fast user switching didn't seem to track users accurately. I'm playing around at the moment using core authentication, and things look like they're better, although I've not had chance to really hammer on it. I'm wondering whether an application running under an inactive user (eg. a web browser) was submitting its own credentials via. NTLM and disrupting the user tracking. If so, we may need to think carefully before allowing any sort of fallback authentication method if we're using fast user switching. Just food for thought. I'll try to provide some more in-depth feedback after I've had chance to play with this a bit more.

Just watch yourself on the scheduled tasks when using asynchronous policy processing to create them. I've been playing with a scheduled task that should run for a user, using the "connection to user session" trigger. The first time I logged on as a user, switched away from the session and switched back, it didn't appear to trigger the task. Only after I logged off and back on did the scheduled task start triggering properly. Just something to watch out for.

Are you trying to deploy a pre-defined Start menu tile layout via. GPO? If so, what format did you use when exporting the Start Menu layout? I'm working off around 18 month old knowledge of how I did it with 8.1, but if I remember correctly you can export the layout as either an XML file or a binary BIN file. I think you need to use the binary format for deployment through Group Policy, so if you're exporting to XML then that might be your problem.

OK, I've been playing around a bit with this on Windows 8.1, and I think I have a rough proof-of-concept framework for getting this to work. The first script (that runs at log-on) is more or less unchanged. Just set the path to the second script and be done with it. LoginScriptLauncher.vbs Option Explicit 'Declare and create shell object Dim objShell Set objShell = WScript.CreateObject("WScript.Shell") 'Run BackgroundProcess.vbs in a separate process (so that the script doesn't get killed by a login 'script time-out threshold). objShell.Run "\\PATH_TO_SCRIPT\BackgroundProcess.vbs", 0, False The second script is the one containing the main code loop. Again, there's a path to a payload script that needs setting. For the moment, I'm using a 5 second sleep time at the end of the script for testing. This will need increasing to a more reasonable value on a production script. Here's the basic logic: When the script first runs, the script obtains the username of the user running the script from the Wscript.Network object. Each time the script loops, it asks WMI for the username of the active console session, and compares it to the username from Wscript.Network. If the usernames match, then the script knows that the user is active, and that it should execute a payload from a third script. If the usernames do not match then this script is clearly running under a user account that is not the active console session, so we don't want to do anything right now. Please note: This works fine for a client system that can't have more than one active console user. It'll produce some "interesting" results if run on a system with multiple active sessions such as a remote desktop server. How "interesting"? I don't know. I haven't tried it. BackgroundProcess.vbs Option Explicit On Error Resume Next 'Declare Objects Dim objShell Dim objNetwork Dim objWMIService Dim strScriptUser Dim strCurrentConsoleUser Dim colItems Dim objItem 'Create shell, network and local computer WMI objects Set objShell = WScript.CreateObject("WScript.Shell") Set objNetwork = CreateObject("Wscript.Network") Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") 'Compile the user name of the user running this script, in the format DOMAIN\username strScriptUser = objNetwork.UserDomain & "\" & objNetwork.UserName 'Begin loop Do While (True) 'Clear strCurrentConsoleUser, just in case the next command fails. I'd rather have 'authentication fail closed, rather than fail open. strCurrentConsoleUser = "" 'Obtain active console user from WMI. The active user is returned in the format DOMAIN\username Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48) For Each objItem in colItems strCurrentConsoleUser = objItem.UserName Next 'Perform case insensitive comparison of strScriptUser and strCurrentConsoleUser. Returns 0 on 'match. Execute payload only if the user account running this script is the active console 'session. If StrComp(strCurrentConsoleUser, strScriptUser, vbTextCompare) = 0 Then objShell.Run "\\PATH_TO_SCRIPT\CommitUserData.vbs", 0, True End If 'Sleep for a predetermined period before attempting to execute the payload again WScript.Sleep 5000 Loop Finally, my test payload script. For now, it appends the current date, time and both versions of the user name to a text file called VBS_Log.txt in the current user profile. This is so that I can check all of the log time stamps and ensure I'm getting the intended behaviour. In the production version of the script, this should be the script that connects to the Smoothwall and sends Kerberos credentials. I've not got far enough to test that yet. I don't have Kerberos enabled on my Smoothwall yet. CommitUserData.vbs Option Explicit On Error Resume Next 'Declare Objects Dim objNetwork Dim objFileSystem Dim objTextFile Dim objWMIService Dim strCurrentConsoleUser Dim objItem Dim colItems 'Create network, file system and WMI objects Set objNetwork = CreateObject("Wscript.Network") Set objFileSystem = CreateObject("Scripting.FileSystemObject") Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") 'Obtain active console user from WMI. The active user is returned in the format DOMAIN\username Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_ComputerSystem",,48) For Each objItem in colItems strCurrentConsoleUser = objItem.UserName Next 'Open a text file in the local user profile. Flag value of 8 means "append" Set objTextFile = objFileSystem.OpenTextFile("C:\Users\" & objNetwork.UserName & "\VBS_Log.txt", 8, True) 'Append the date, time and user name of the user account under which this script is running objTextFile.WriteLine(Date & " " & Time & " " & objNetwork.UserDomain & "\" & objNetwork.UserName & " " & strCurrentConsoleUser) There's one last thing that needs to be taken care of. When we fast user switch back to an idle session, we need to ensure that CommitUserData.vbs runs immediately to update the Smoothwall authentication data. I reckon this can be done through a scheduled task in Group Policy. The trigger to use should be "Connection to user session", "from local computer". Also, the settings need to be configured so that the task can run when the computer is on battery, as the default is only to run when on AC power. I'm still playing around with this to ensure it works as intended, but my initial trials look good, and I reckon the logic is sound. If anyone else wants to take a look, play around and report back, feel free to give it a go. Any feedback would be appreciated.

Yeah, my proposed idea would still result in multiple scripts running in the background as all the inactive users, but because the script would check if it was running in the context of an active session before trying to re-autheticate, it wouldn't be submitting credentials for the inactive user accounts, although it would still be using some CPU and RAM in the background. It'd be clunky, but hopefully it'd work.

I was just looking into the possibility of implementing scripted Kerberos authentication myself, and hadn't really considered the issues raised by fast user switching, so thanks for the heads up on this being a potential issue. I'm going to have a play around over the next few days and see if I can come up with a solution. I've already got the outline of a plan in my head, which will involve (A) modifying the existing script so that it checks that the user session under which it's running is the active one before it tries to resubmit user credentials, and (B) using group policy to run a per-user scheduled task on machine unlock so that a script can submit new credentials as soon as someone switches back to an active session. I've not had the chance to test any of this stuff in practice or work out any possible kinks arising from this, but I think the general idea is probably sound. If I manage to come up with a working solution some time next week then I'll try to come back and post it here.

I'm using NetXMS from https://www.netxms.org/ It's got a bit of a learning curve, but runs on Windows and has a GUI console available for configuration. To be honest, I don't tend to use the console much unless I'm changing configurations. I have thresholds set for most of the important stuff (such as low disk space, high CPU usage for an extended period, services not running etc.) and just rely on it sending me email if something important goes offline.

I've not had the opportunity to look into how executable signing works in Visual Studio, but I wonder whether it's possible to have it automatically sign the executables it creates using a trusted certificate from an internal CA. If that's possible then you could just create a certificate rule in software restriction policies to allow said signed executables to run. That's just a quick thought of the top of my head - I have no idea if it's feasible to implement in the real world.

The .TemporaryItems folder was there, and was writeable by the users. It didn't make the slightest bit of difference for us.

If you have the home directory set in AD, you can read the attribute with a terminal command, but it'll be in windows format ie. \\servername\sharename\path\homedirectory. You'll need to do some regular expression work to convert the path into a mac-style path ie /volumes/sharename/path/homedirectory. Try running the following command as a mac user and see if it returns your home directory. If so, you're golden. If not, you'll have to figure out how to query AD for group memberships, profile locations etc. on your own and build the path string yourself. dscl /Active\ Directory/All\ Domains -read /Users/$USER SMBHome | grep \\\\\\\\.* -o I do this in three stages - I extract the windows formatted path from AD, replace the server name with /volumes/, then replace all remaining backslashes with forward slashes. I'll post my script below for reference but it'll need some tweaking as mine is hard-coded to expect a server name of FS01 or FS02. There are a lot of backslashes in the script - most of them are escape characters, but I've tried to explain in the comments how many backslashes (in the script) represent a single one in the string. #/bin/bash #Read the Windows formatted SMB path to the user's home directory #Stores only the URL string from \\ onwards #Note that four backslashes represent a single backslash here WinFormattedDirectory=`dscl /Active\ Directory/All\ Domains -read /Users/$USER SMBHome | grep \\\\\\\\.* -o` #If AD fails to return a path to the user space, don't proceed as we don't want to break the user's documents folder #This is particularly important if the user is logged in as a local user if [ $? -eq 0 ] then #Replace the server name \\FS0[0-9] from the start of the string with /Volumes to give us the share name and path #Note that eight backslashes represent a single backslash here ShortenedWinFormattedDirectory=`echo $WinFormattedDirectory | sed s/\\\\\\\\\\\\\\\\fs0[0-9]/\\\\/Volumes/` #Replace all backslashes with forward slashes #Note that eight backslashes represent a single backslash here MacFormattedDirectory=`echo $ShortenedWinFormattedDirectory | sed s/\\\\\\\\/\\\\//g` #Change permissions on local documents folder so that we can delete it chmod -R -N ~/Documents #Remove the local Documents folder rm -rf ~/Documents #Create a SymLink to the network documents folder ln -s $MacFormattedDirectory ~/Documents #Create Downloads directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/Downloads #Change permissions on local Downloads folder so that we can delete it chmod -R -N ~/Downloads #Remove the local Downloads folder rm -rf ~/Downloads #Create a SymLink to the network Downloads folder ln -s ~/Documents/Downloads ~/Downloads #Create My Videos directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Videos #Change permissions on local Movies folder so that we can delete it chmod -R -N ~/Movies #Remove the local Movies folder rm -rf ~/Movies #Create a SymLink to the network My Videos folder ln -s ~/Documents/My\ Videos ~/Movies #Create My Music directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Music #Change permissions on local Music folder so that we can delete it chmod -R -N ~/Music #Remove the local Music folder rm -rf ~/Music #Create a SymLink to the network My Music folder ln -s ~/Documents/My\ Music ~/Music #Create My Pictures directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Pictures #Change permissions on local Pictures folder so that we can delete it chmod -R -N ~/Pictures #Remove the local Pictures folder rm -rf ~/Pictures #Create a SymLink to the network My Pictures folder ln -s ~/Documents/My\ Pictures ~/Pictures fi Whatever you do, don't invoke this script from an AppleScript - it'll break spectacularly as AppleScript expects yet more backslashes to escape characters. I used a utility called Platypus to build an App package containing the script (which doesn't appear in the dock and closes once it completes), and then just run that App at logon. This avoids the user being left with a visible, running instance of terminal once the script completes. I hope this makes vague sense.

If you have the home directory set in AD, you can read the attribute with a terminal command, but it'll be in windows format ie. \\servername\sharename\path\homedirectory. You'll need to do some regular expression work to convert the path into a mac-style path ie /volumes/sharename/path/homedirectory. Try running the following command as a user and see if it returns the home directory path. If so, you're golden: dscl /Active\ Directory/All\ Domains -read /Users/$USER SMBHome | grep \\\\\\\\.* -o I do this in three stages - I extract the windows formatted path from AD, replace the server name with /volumes/, then replace all remaining backslashes with forward slashes. I'll post my script below for reference but it'll need some tweaking as mine is hard-coded to expect a server name of FS01 or FS02. There are a lot of backslashes in the script - most of them are escape characters, but I've tried to explain in the comments how many backslashes (in the script) represent a single one in the string. #/bin/bash #Read the Windows formatted SMB path to the user's home directory #Stores only the URL string from \\ onwards #Note that four backslashes represent a single backslash here WinFormattedDirectory=`dscl /Active\ Directory/All\ Domains -read /Users/$USER SMBHome | grep \\\\\\\\.* -o` #If AD fails to return a path to the user space, don't proceed as we don't want to break the user's documents folder #This is particularly important if the user is logged in as a local user if [ $? -eq 0 ] then #Replace the server name \\FS0[0-9] from the start of the string with /Volumes to give us the share name and path #Note that eight backslashes represent a single backslash here ShortenedWinFormattedDirectory=`echo $WinFormattedDirectory | sed s/\\\\\\\\\\\\\\\\fs0[0-9]/\\\\/Volumes/` #Replace all backslashes with forward slashes #Note that eight backslashes represent a single backslash here MacFormattedDirectory=`echo $ShortenedWinFormattedDirectory | sed s/\\\\\\\\/\\\\//g` #Change permissions on local documents folder so that we can delete it chmod -R -N ~/Documents #Remove the local Documents folder rm -rf ~/Documents #Create a SymLink to the network documents folder ln -s $MacFormattedDirectory ~/Documents #Create Downloads directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/Downloads #Change permissions on local Downloads folder so that we can delete it chmod -R -N ~/Downloads #Remove the local Downloads folder rm -rf ~/Downloads #Create a SymLink to the network Downloads folder ln -s ~/Documents/Downloads ~/Downloads #Create My Videos directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Videos #Change permissions on local Movies folder so that we can delete it chmod -R -N ~/Movies #Remove the local Movies folder rm -rf ~/Movies #Create a SymLink to the network My Videos folder ln -s ~/Documents/My\ Videos ~/Movies #Create My Music directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Music #Change permissions on local Music folder so that we can delete it chmod -R -N ~/Music #Remove the local Music folder rm -rf ~/Music #Create a SymLink to the network My Music folder ln -s ~/Documents/My\ Music ~/Music #Create My Pictures directory in network My Documents folder if it doesn't already exist mkdir ~/Documents/My\ Pictures #Change permissions on local Pictures folder so that we can delete it chmod -R -N ~/Pictures #Remove the local Pictures folder rm -rf ~/Pictures #Create a SymLink to the network My Pictures folder ln -s ~/Documents/My\ Pictures ~/Pictures fi Whatever you do, don't invoke this script from an AppleScript - it'll break spectacularly as AppleScript expects yet more backslashes to escape characters. I used a utility called Platypus to build an App package containing the script (which doesn't appear in the dock and closes once it completes), and then just run that App at logon. This avoids the user being left with a visible, running instance of terminal once the script completes. I hope this makes vague sense.

Yes, Office breaks when you do this. 2008 has the same problem when using the legacy document formats (DOC, XLS, PPT) although the newer formats (DOCX etc.) seem to be fine. In the end, I left the "Force local home directory on startup disk" enabled, then ran a login script to delete the documents, pictures, music, videos and downloads folders from the local user profile, replacing them with Symlinks to the mounted network volume. This essentially redirects these folders for the user, so that when they log in, all their applications default to saving in their network My Documents/My Music/My Pictures folders. The benefit to doing this is you can choose to only redirect certain folders. On our system, for example, Library and Desktop remain local.